What WooCommerce Stripe Payment Gateway does in your store
WooCommerce Stripe Payment Gateway connects a WooCommerce store to a Stripe account. Billed as the official plugin from Stripe and WooCommerce, it adds card payments, express checkouts (Apple Pay, Google Pay, Link), buy now, pay later options (Klarna, Affirm, Afterpay) and local methods such as SEPA Direct Debit, iDEAL, Bancontact and BLIK to your checkout. Its settings live under WooCommerce > Settings > Payments > Stripe.
Card numbers are typed into Stripe Elements fields hosted by Stripe, so they never pass through your server. Stripe then reports payment results back to WordPress through webhooks, which have been set up automatically when you connect your account since version 8.6.1. The list of enabled payment methods stays in sync with your Stripe Dashboard. Since version 10.8.0, the Optimized Checkout Suite, which orders payment methods for each shopper, and Adaptive Pricing, which shows prices in the shopper’s local currency, are on by default for eligible stores.
The plugin itself is free. You pay Stripe’s fees on every successful payment: for an account in France, Stripe’s public pricing lists 1.5% + €0.25 per standard European Economic Area card, with no setup or monthly fees. Refunds, disputes, Radar fraud rules and payouts are mostly managed in the Stripe Dashboard.
Which stores the Stripe plugin suits best
The plugin makes sense when you have, or are willing to open, a Stripe account in one of the 46 countries where Stripe serves merchants:
- Stores selling across Europe that want to offer their customers’ local methods (SEPA, iDEAL, Bancontact, BLIK, Przelewy24).
- Mobile-heavy stores counting on Apple Pay, Google Pay and Link to shorten checkout on phones.
- Subscription businesses using WooCommerce Subscriptions, which relies on payment methods saved with Stripe for renewals.
- Merchants already on Stripe for other sales, who keep one dashboard, one account and the same Radar rules.
It is the wrong pick if your business is based outside Stripe’s supported countries, or if you want to handle disputes and payouts from the WordPress admin: WooPayments builds those screens into WooCommerce, on its own terms.
Strengths and limits of the Stripe plugin for WooCommerce
Strengths
- A long list of payment methods. Cards, wallets, buy now, pay later and local methods are all switched on from one Payment Methods tab.
- Card data stays off your server. Stripe Elements fields simplify PCI DSS compliance, and Strong Customer Authentication (3D Secure) is supported.
- Radar included. Stripe’s fraud screening checks every payment with no setup in WordPress.
- Easy connection. You link the account in a few clicks and webhooks configure themselves, in both live and test mode.
Limits
- Management split with Stripe. Radar rules can’t be configured in the plugin, and disputes and payouts are tracked in the Stripe Dashboard.
- Fees on every sale. Stripe charges per payment, €20 per dispute received in France, and Radar for Fraud Teams adds a per-transaction cost.
- Saved cards need an account. A shopper who checks out as a guest can’t save a card for next time.
- Updates that change checkout. Version 10.8.0 turned on the Optimized Checkout Suite and Adaptive Pricing by default for existing stores, so test after every major update.
The Stripe settings we recommend
Paths start from WooCommerce > Settings > Payments > Stripe. After each change, place a test order before going back to live mode.
| Setting | Recommended value | Why |
|---|---|---|
| Enable test mode Settings > General | Off on the live store, on for a staging copy | In test mode, no real money is collected. |
| Webhook status Settings > Account details > Configure connection | “Configured” on both the Live and Test tabs | Stripe updates your store through webhooks, and some payment methods depend on them. If not, click “Reconfigure webhooks”. |
| Payment methods Payment Methods tab | Only the ones your customers actually use | Each method enabled here is enabled in Stripe too; fewer methods means fewer cases to test. |
| Enable saved card payment methods Settings > Payments & transactions | On if customers have accounts, otherwise it has no effect | Speeds up repeat purchases; the card stays with Stripe, not in WordPress. |
| Issue an authorization on checkout, and capture later Settings > Payments & transactions | Off (default) | An uncaptured authorization expires after 7 days, and methods that don’t support it disappear from checkout. |
| Add customer order number to the bank statement Settings > Payments & transactions | On, with a readable shortened statement descriptor | Customers can match the line on their statement to your order more easily. |
| Log debug messages Settings > Advanced settings > Debug mode | Off, except while troubleshooting | It logs all plugin activity to the WooCommerce logs: turn it off once the issue is fixed. |
- In the Stripe Dashboard, open Radar and add rules that fit your customers (card issuing country, card type).
- In WooCommerce, turn on checkout rate limiting to slow down card-testing bots.
- Place a small real order, refund it, and check that the order status follows in WooCommerce.
- Under Plugins, enable auto-updates for WooCommerce Stripe Payment Gateway.
Past vulnerabilities in the Stripe plugin and what to do
Like any gateway that sits on the checkout page, the plugin has had several vulnerabilities, all patched:
- June 2023, CVE-2023-34000: an unauthenticated IDOR exposed personal data tied to orders (CVSS 7.5). Together with CVE-2023-35049, a broken access control flaw, it affected versions up to 7.4.0 and was fixed in 7.4.1.
- Late 2023, CVE-2023-44999 and CVE-2023-51502: a CSRF flaw fixed in 7.6.1, then another IDOR fixed in 7.6.2.
- June 2026, CVE-2026-2381: up to version 10.7.0, an unauthenticated visitor could push pending orders to “Failed” through the express checkout endpoint (CVSS 6.5). Fixed in 10.8.0.
Version 11.1.0 also removes account password data that express checkout in version 10.9.0 may have stored in order metadata, so stay on the latest release, 11.1.0 at a minimum. Card fraud and customer account protection are covered in our WooCommerce store security guide. WP Masquerade Pro renames the woocommerce-gateway-stripe folder and its script IDs, which makes the plugin harder for bots to spot but does not replace updating; the wc_stripe_params variable, the script loaded from js.stripe.com and the __stripe_mid and __stripe_sid cookies stay visible.
What WP Masquerade hides for WooCommerce Stripe Payment Gateway
Pro Handled by WP Masquerade Pro only
The free version does not know the traces specific to WooCommerce Stripe Payment Gateway: without Pro, only generator tags are removed, as for any plugin.
Free version
Handled by WP Masquerade Pro only
With Pro
- folder name
- tag IDs
Still visible
- JavaScript variables
wc_stripe_params - files served by the vendor
js.stripe.com - cookies
__stripe_mid, __stripe_sid
These traces stay because the plugin needs them to work (scripts, styles, cookies) or because they come from the server.
WooCommerce Stripe Payment Gateway FAQ
Does the Stripe plugin for WooCommerce cost anything?
No, the plugin is free. You pay Stripe’s fees on each successful payment, for example 1.5% + €0.25 per standard EEA card for an account in France, plus €20 per dispute received.
Do I need an SSL certificate to use Stripe?
Yes. In live mode, the plugin requires the store to be served over HTTPS. Test mode works with test keys and collects no real money.
Can customers save their card without creating an account?
No. Saving cards requires a customer account on the store; a guest order can’t keep a payment method. WooCommerce Subscriptions renewals work even with this setting turned off.
Stripe or WooPayments: which one should I choose?
Both come from the WooCommerce team. The Stripe plugin connects straight to your own Stripe account, managed in the Stripe Dashboard; WooPayments brings payments, disputes and payouts into the WordPress admin and uses a WordPress.com account.